Abhinav 2994f545a7 Enforce managed authentication requirements locally (#37132) ...

## Why

Authentication restrictions must apply before stored or environment-provided credentials can be used, including during bootstrap before cloud requirements are fetched.

## What changed

- Add local `requirements.toml` allowlists for login methods and ChatGPT workspaces. Ignore these fields in cloud-provided requirements.
- Combine managed workspace allowlists with existing workspace restrictions by intersection, and fail closed when the resulting policy permits no usable login method.
- Centralize policy checks in the authentication manager so CLI, TUI, app-server, external-auth, and credential-loading paths consistently reject disallowed authentication before token hydration or network requests.

## Testing

- Cover policy composition, workspace intersection, invalid stored and external credentials, bootstrap enforcement, and login endpoint restrictions.

GitOrigin-RevId: efef22b248f3c3333e9aa55423e539efa2d2dd48

2026-08-05 18:09:26 +00:00

..

src

Enforce managed authentication requirements locally (#37132)

2026-08-05 18:09:26 +00:00

tests

cloud-tasks: split the mock client out of cloud-tasks-client (#16456)

2026-04-01 12:09:14 -07:00

BUILD.bazel

Wire realtime WebRTC native media into Bazel (#17145)

2026-04-08 15:15:55 -07:00

Cargo.toml

Fix TUI layout for halfwidth Japanese sound marks (#35962)

2026-07-29 14:01:31 +00:00